Enterprise Microsoft Q&A: Hello for Buttprint

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > Enterprise Microsoft Q&A: Hello for Buttprint

«‹›261 »

Nebulis01: Dec 30, 2003; Technical Support Ninny

I'm pretty sure (according to a quick googling) that Samba supports DFS or similar. So I'd even take it further and go \\domain.here\namespacehere\stuff - that way down the road you can replace the server(s) underneath the shares and nobody is the wiser, no shortcuts to update or anything.

You can keep the letter maps if you need to.

# ? Jan 20, 2015 20:41

Adbot: ADBOT LOVES YOU

# ? May 13, 2024 22:23

Gyshall: Feb 24, 2009; Had a couple of drinks.
Saw a couple of things.

People posting ITT not knowing about Access Based Enumeration

Gyshall fucked around with this message at 14:33 on Jan 22, 2015

# ? Jan 20, 2015 20:52

devmd01: Mar 7, 2006; Elektronik
Supersonik

Single root dfs namespace with access based enumeration backed by a good HA cluster is the poo poo, map one drive letter and you're done. Keep good _FA and _RO groups per folder and granting access is a 10 second AD lookup. The trick is the effort required to get there if you're spread across lots of servers, shares, etc.

# ? Jan 20, 2015 21:53

Orcs and Ostriches: Aug 26, 2010; The Great Twist

Does anyone know why a subset of machines would have trouble updating their dynamic dns in a windows environment? Just out of the blue we've had 20 or so machines (all out of a batch of 60 that have been imaged in the last couple months) stopping to update, and their record goes stale and gets scavenged. They're getting dhcp addresses properly, and every other machine is working as normal.

Only places I can think to look are the dns and dhcp logs on the clients/servers, but according to them everything is ok.

# ? Jan 20, 2015 22:15

skipdogg: Nov 29, 2004; Resident SRT-4 Expert

Orcs and Ostriches posted:

Does anyone know why a subset of machines would have trouble updating their dynamic dns in a windows environment? Just out of the blue we've had 20 or so machines (all out of a batch of 60 that have been imaged in the last couple months) stopping to update, and their record goes stale and gets scavenged. They're getting dhcp addresses properly, and every other machine is working as normal.

Only places I can think to look are the dns and dhcp logs on the clients/servers, but according to them everything is ok.

What happens if you do an ipconfig /registerdns ? Any error on the client machine? It would be in the event log somewhere "unable to update blah blah dns blah blah"

My gut says this is a permission issue based on some sort of failure of the computer account to authenticate to AD and update it's own DDNS record. Either something is preventing it, or it doesn't have the permissions.

Double check your DHCP server options, make sure everything in there is setup properly regarding the registration of dns records.

How do you image your machines? Do you use Sysprep or some other SID modifier?

# ? Jan 20, 2015 22:23

Orcs and Ostriches: Aug 26, 2010; The Great Twist

skipdogg posted:

What happens if you do an ipconfig /registerdns ? Any error on the client machine? It would be in the event log somewhere "unable to update blah blah dns blah blah"

My gut says this is a permission issue based on some sort of failure of the computer account to authenticate to AD and update it's own DDNS record. Either something is preventing it, or it doesn't have the permissions.

Double check your DHCP server options, make sure everything in there is setup properly regarding the registration of dns records.

How do you image your machines? Do you use Sysprep or some other SID modifier?

ipconfig /registerdns eventually returns The DNS server's response to a query for name COMPUTER.DOMAIN indicates that no records of the type queried are available, but could indicate that other records for the same name are present. in the DNS Client Event log

Everything's sysprepped, and there are 90 other machines using the same image, so I think that should be safe.

And as far as I can tell, DHCP is still set up right. It only ever gets touched for updates, so the configuration shouldn't have changed.

I agree that it feels like an AD authentication issue. The problem arose when the computers in question all failed logins with The trust relationship between this workstation and the primary domain failed. After closer inspection, AD accounts were never created for these computers when they joined the domain. Rejoining doesn't help, nor does rejoining with a precreated account. Strangely, it appears valid from the client's side, and we can successfully log into domain accounts for the day.

I actually sysprepped one of the machines again, and tried the process from scratch, with no success. I figured that it was a DNS issue, because the records weren't being created, but in second thought it seems like it's an AD issue first, which is also causing the DNS issue.

# ? Jan 20, 2015 22:33

skipdogg: Nov 29, 2004; Resident SRT-4 Expert

Orcs and Ostriches posted:

The trust relationship between this workstation and the primary domain failed.

I was afraid of that. Usually force removing the client from the domain, deleting the computer object and DNS records in AD, then rejoining the domain fixes it.

Something is jacked up

# ? Jan 20, 2015 23:52

CLAM DOWN: Feb 13, 2007

skipdogg posted:

I was afraid of that. Usually force removing the client from the domain, deleting the computer object and DNS records in AD, then rejoining the domain fixes it.

Something is jacked up

Do this instead first:

code:

netdom resetpwd /server:dc01.domain /userd:domain\domain_admin_username

That trust relationship issue can sometimes be fixed by this.

# ? Jan 20, 2015 23:57

TheEffect: Aug 12, 2013

Any idea why Spiceworks gives me a total list of PCs that I have access to via the DC, but Windows Active Directory Administrative Center is giving me an entirely different list of PCs that is only about 5% complete?

# ? Jan 21, 2015 16:43

AAB: Nov 5, 2010

e: eh, exchange so taking it to the exchange thread.

# ? Jan 21, 2015 16:53

MF_James: May 8, 2008; I CANNOT HANDLE BEING CALLED OUT ON MY DUMBASS OPINIONS ABOUT ANTI-VIRUS AND SECURITY. I REALLY LIKE TO THINK THAT I KNOW THINGS HERE

INSTEAD I AM GOING TO WHINE ABOUT IT IN OTHER THREADS SO MY OPINION CAN FEEL VALIDATED IN AN ECHO CHAMBER I LIKE

Going to move this to CoC once I get my thoughts together and look at this some more.

MF_James fucked around with this message at 22:46 on Jan 21, 2015

# ? Jan 21, 2015 21:11

Gucci Loafers: May 20, 2006; Ask yourself, do you really want to talk to pair of really nice gaudy shoes?

Couldn't you make this two steps? Export the name of all the objects in a OU to a .csv such as ou1.csv then have ps read ou1.csv and move those objects?

# ? Jan 21, 2015 21:18

MF_James: May 8, 2008; I CANNOT HANDLE BEING CALLED OUT ON MY DUMBASS OPINIONS ABOUT ANTI-VIRUS AND SECURITY. I REALLY LIKE TO THINK THAT I KNOW THINGS HERE

INSTEAD I AM GOING TO WHINE ABOUT IT IN OTHER THREADS SO MY OPINION CAN FEEL VALIDATED IN AN ECHO CHAMBER I LIKE

Tab8715 posted:

Couldn't you make this two steps? Export the name of all the objects in a OU to a .csv such as ou1.csv then have ps read ou1.csv and move those objects?

But it won't know which OU to move them to? We are going from 8 OUs to 22 OUs, the current OU structure and what objects are in them isn't going to matter or help with the structure we're going to. Actually our current structure.. now that i think about it, is 9 OUs, 1 OU has 2200 objects, 6 of them have 300 or so in each and the last 2 have the rest.

Unless I misunderstood what you were saying.

# ? Jan 21, 2015 21:26

skipdogg: Nov 29, 2004; Resident SRT-4 Expert

There's a powershell thread in CoC that is really useful

http://forums.somethingawful.com/showthread.php?threadid=3286440

This may not be the best way to do it, but I would add a column to your CSV that has the target OU in it, move the $targetOU variable into the for each loop then do something like this

code:

$ComputersPath = Import-CSV c:\myfile.csv

foreach ($item in $ComputersPath){
$computer = Get-ADComputer $item.CompName
$targetOU = $item.OU

Move-ADObject -Identity $computer.DistinguishedName -TargetPath $targetOU -Confirm:$false
}

I didn't check your code to test it, but that's how I would approach it

You already have 22 files, each one of those is for it's own OU right?

# ? Jan 21, 2015 21:28

MF_James: May 8, 2008; I CANNOT HANDLE BEING CALLED OUT ON MY DUMBASS OPINIONS ABOUT ANTI-VIRUS AND SECURITY. I REALLY LIKE TO THINK THAT I KNOW THINGS HERE

INSTEAD I AM GOING TO WHINE ABOUT IT IN OTHER THREADS SO MY OPINION CAN FEEL VALIDATED IN AN ECHO CHAMBER I LIKE

skipdogg posted:

There's a powershell thread in CoC that is really useful

http://forums.somethingawful.com/showthread.php?threadid=3286440

This may not be the best way to do it, but I would add a column to your CSV that has the target OU in it, move the $targetOU variable into the for each loop then do something like this
code:
$ComputersPath = Import-CSV c:\myfile.csv

foreach ($item in $ComputersPath){
$computer = Get-ADComputer $item.CompName
$targetOU = $item.OU

Move-ADObject -Identity $computer.DistinguishedName -TargetPath $targetOU -Confirm:$false
}
I didn't check your code to test it, but that's how I would approach it

You already have 22 files, each one of those is for it's own OU right?

Yes, 22 files each represents an OU we are creating, the files contain only location name though, we have 2 objects per location (HOST000001 and GUEST000001) and the file is setup as 0000001, 0000002, 000003, etc

Also, thanks I didn't realize there was a PS thread in CoC (I honestly didn't even think about it)

# ? Jan 21, 2015 21:36

Potato Salad: Oct 23, 2014; nobody cares

Gyshall posted:

People posting ITT not knowing about [url=http://technet.microsoft.com/en-us/library/dd772681%28v=ws.10%29.aspx]Access Based Enumeration[/spoiler]

So, I know what I'm setting up the second I walk in the office tomorrow.

Thanks for that nugget.

# ? Jan 22, 2015 04:37

BaseballPCHiker: Jan 16, 2006

Is there a way in SCCM 2012 to make a package and deployment use a specific distribution point? I setup a secondary dp and uploaded the content and when I deployed the software update package it seemed to still be going over our VPN to the primary site. I thought it would just automatically take the content from the closest dp but I guess not.

I get so frustrated working with SCCM. I'm trying to educate myself on it as much as I can but without work scheduling class time due to how busy we are I'm left to books and blogs which have only taken me so far.

# ? Jan 22, 2015 22:22

Zaepho: Oct 31, 2013

BaseballPCHiker posted:

Is there a way in SCCM 2012 to make a package and deployment use a specific distribution point? I setup a secondary dp and uploaded the content and when I deployed the software update package it seemed to still be going over our VPN to the primary site. I thought it would just automatically take the content from the closest dp but I guess not.

I get so frustrated working with SCCM. I'm trying to educate myself on it as much as I can but without work scheduling class time due to how busy we are I'm left to books and blogs which have only taken me so far.

Content location is dependent on the boundary group that the DP is assigned to and the which Boundary Group the client falls into at the time. Plus add in the ability to fall back to another DP if the content is not available within the current boundary group.

What we do for boundary groups on our engagements is to create "Site Assignment" boundary groups that are used only for assigning clients to the correct site. Secondly we setup "Content Boundary Groups" that are used expressly for directing clients to the appropriate DP for their location.

# ? Jan 22, 2015 22:39

BaseballPCHiker: Jan 16, 2006

Zaepho posted:

Content location is dependent on the boundary group that the DP is assigned to and the which Boundary Group the client falls into at the time. Plus add in the ability to fall back to another DP if the content is not available within the current boundary group.

What we do for boundary groups on our engagements is to create "Site Assignment" boundary groups that are used only for assigning clients to the correct site. Secondly we setup "Content Boundary Groups" that are used expressly for directing clients to the appropriate DP for their location.

Thanks for the tip. Gives me something to look into. Do you have any general books or sites to recommend? I've been reading the windows-noob forum guides, the deploy-happiness blog, and bought the System Center mastering the fundamentals book as well.

# ? Jan 22, 2015 23:06

Hadlock: Nov 9, 2004

skipdogg posted:

There's a powershell thread in CoC that is really useful

http://forums.somethingawful.com/showthread.php?threadid=3286440

Welp, add that to the OP, I could have used that over the last 18 months for sure.

# ? Jan 22, 2015 23:09

skipdogg: Nov 29, 2004; Resident SRT-4 Expert

BaseballPCHiker posted:

Thanks for the tip. Gives me something to look into. Do you have any general books or sites to recommend? I've been reading the windows-noob forum guides, the deploy-happiness blog, and bought the System Center mastering the fundamentals book as well.

I haven't found books to be very useful for learning about SCCM. All the good stuff is on various SCCM blogs. A book might be useful for getting a good understanding of all the parts though, so there could be some value there. For specific issues though it's always been a google search to some guys blog for the answer.

# ? Jan 22, 2015 23:13

FISHMANPET: Mar 3, 2007; Sweet 'N Sour
Can't
Melt
Steel Beams

Hadlock posted:

Welp, add that to the OP, I could have used that over the last 18 months for sure.

I just did that, for whatever pathetic excuse of an OP it is.

Also holy poo poo I started this thread nearly 5 years ago. Back then I was starting from nothing with a blank SCCM 2007 install, and I just started a job running an SCCM instance that manages over 25k computers.

# ? Jan 22, 2015 23:32

Sacred Cow: Aug 13, 2007

BaseballPCHiker posted:

Thanks for the tip. Gives me something to look into. Do you have any general books or sites to recommend? I've been reading the windows-noob forum guides, the deploy-happiness blog, and bought the System Center mastering the fundamentals book as well.

ConfigMgrDogs is a pretty great blog to follow. They cover a lot of the obscure stuff and automating with PowerShell. A recent post had a script that provides a SCCM plugin for PowerShell ISE that I can't live without now. You can also check out Channel 9 and do a search for SCCM TechEd conferences.

# ? Jan 23, 2015 00:45

CLAM DOWN: Feb 13, 2007

Server 2012 R2 RDP certificate.

Why the gently caress did MS remove the RD Host Configuration tool? Is the only way to set a certificate on a workgroup machine like this:

code:

$path = (Get-WmiObject -class "Win32_TSGeneralSetting" -Namespace root\cimv2\terminalservices -Filter "TerminalName='RDP-tcp'").__path
Set-WmiInstance -Path $path -argument @{SSLCertificateSHA1Hash="%sha1_thumbprint_pulled_from_certficiate_properties_in_personal_store%"}

I know you can deploy this stuff with group policy, but I'm talking about a workgroup machine here. Local policy only lets you specific a template for enrollment, but autoenrollment isn't possible in this case so this is for a manually issued cert. We used to do this in 2008 R2 with the RD Host Configuration, going to the properties of the RDP-Tcp connection.

# ? Jan 23, 2015 01:28

Zaepho: Oct 31, 2013

BaseballPCHiker posted:

Thanks for the tip. Gives me something to look into. Do you have any general books or sites to recommend? I've been reading the windows-noob forum guides, the deploy-happiness blog, and bought the System Center mastering the fundamentals book as well.

I would echo what the others have said and add on that the MyITForum community is a great resource for SCCM. Its your best link to pretty much every SCCM MVP out there. Try to make it out to Ignite and see if you can network your way into chatting with some of the SCCM Community big names and you'll get a LOT of information that you'll never get from any book or training class.

SCCM is a tool you just have to work with and eventually it will click and things will start to make more sense. Unfortunately there's a lot of stuff to understand at the foundation level to be able to make the most of SCCM so it'll take some time.

# ? Jan 23, 2015 15:23

Dr. Arbitrary: Mar 15, 2006; Bleak Gremlin

I am getting my butt kicked by a print server.

I've got sever2012r2, I'm trying to deploy a printer in group policy and it just doesn't show up on the target computer. Group policy modeling shows that the printer should show up.

Are there some common issues that I should know about with this kind of thing?

How do I even start troubleshooting?

I see an error in the event log that says "Failed to connect to server" but I can't tell if it's related.

# ? Jan 25, 2015 18:18

Matt Zerella: Oct 7, 2002; Norris'es are back baby. It's good again. Awoouu (fox Howl)

Dr. Arbitrary posted:

I am getting my butt kicked by a print server.

I've got sever2012r2, I'm trying to deploy a printer in group policy and it just doesn't show up on the target computer. Group policy modeling shows that the printer should show up.

Are there some common issues that I should know about with this kind of thing?

How do I even start troubleshooting?

I see an error in the event log that says "Failed to connect to server" but I can't tell if it's related.

Can you ping the server from the client?

# ? Jan 25, 2015 18:29

hihifellow: Jun 17, 2005; seriously where the fuck did this genre come from

Dr. Arbitrary posted:

I am getting my butt kicked by a print server.

I've got sever2012r2, I'm trying to deploy a printer in group policy and it just doesn't show up on the target computer. Group policy modeling shows that the printer should show up.

Are there some common issues that I should know about with this kind of thing?

How do I even start troubleshooting?

I see an error in the event log that says "Failed to connect to server" but I can't tell if it's related.

Computer itself will need the print security right to map the driver if the GPO is targeting a computer, so if the printer has restricted rights add domain computers to it. If that's not the case, check the rights on the print$ share (it should be Everyone/All Rights) and the firewall. Also that you didn't misspell the printer in the GPO. Might want to try mapping the printer without a GPO just to make sure you can.

# ? Jan 25, 2015 18:32

incoherent: Apr 24, 2004; 01010100011010000111001
00110100101101100011011
000110010101110010

hihifellow posted:

Computer itself will need the print security right to map the driver if the GPO is targeting a computer, so if the printer has restricted rights add domain computers to it. If that's not the case, check the rights on the print$ share (it should be Everyone/All Rights) and the firewall. Also that you didn't misspell the printer in the GPO. Might want to try mapping the printer without a GPO just to make sure you can.

You can right-click deploy via GPO in print server (08 R2 and later).

# ? Jan 25, 2015 19:17

Dr. Arbitrary: Mar 15, 2006; Bleak Gremlin

incoherent posted:

You can right-click deploy via GPO in print server (08 R2 and later).

This is how I'm doing it for reference.

This is how I'm deploying.

hihifellow posted:

Computer itself will need the print security right to map the driver if the GPO is targeting a computer, so if the printer has restricted rights add domain computers to it. If that's not the case, check the rights on the print$ share (it should be Everyone/All Rights) and the firewall. Also that you didn't misspell the printer in the GPO. Might want to try mapping the printer without a GPO just to make sure you can.

Would this be Point and Print restrictions for the computer account?

I'm assuming enabled?

Edit:

I might try disabled first. If it works, I'll enable and tweak the settings until I get it right.

Otherwise, maybe it's a different setting.

Dr. Arbitrary fucked around with this message at 19:47 on Jan 25, 2015

# ? Jan 25, 2015 19:44

hihifellow: Jun 17, 2005; seriously where the fuck did this genre come from

Point and print restrictions are if a user can map a printer that has a driver that brings up a UAC prompt; I always enable it then set it not to prompt. But that doesn't sound like the case since that would show up in the event log.

# ? Jan 25, 2015 20:01

FISHMANPET: Mar 3, 2007; Sweet 'N Sour
Can't
Melt
Steel Beams

First thing in troubleshooting mapping of drives and printers via GPO: manually map the drive or printer and see what happens.

# ? Jan 25, 2015 20:03

Dr. Arbitrary: Mar 15, 2006; Bleak Gremlin

FISHMANPET posted:

First thing in troubleshooting mapping of drives and printers via GPO: manually map the drive or printer and see what happens.

Well, I'm an idiot for not trying this first.

I bet my policies are perfect now though.

# ? Jan 25, 2015 21:00

MC Fruit Stripe: Nov 26, 2002; around and around we go

Got asked a question I have absolutely no idea how to answer.

Can you verify that your Active Directory environment is using Kerberos?

I have no idea. I know it does, of course it does, but how do I demonstrate that?

# ? Jan 26, 2015 23:32

wyoak: Feb 14, 2005; a glass case of emotion; Fallen Rib

MC Fruit Stripe posted:

Got asked a question I have absolutely no idea how to answer.

Can you verify that your Active Directory environment is using Kerberos?

I have no idea. I know it does, of course it does, but how do I demonstrate that?

Could run klist.exe, that shows you a list of cached kerberos tickets. If you're not running kerberos you wouldn't get any tickets. If you wanted to get more in depth, stop the netlogon service, fire up wireshark or similar packet monitor, then start netlogon, you'll capture your system negotiating with a DC.

# ? Jan 26, 2015 23:35

FISHMANPET: Mar 3, 2007; Sweet 'N Sour
Can't
Melt
Steel Beams

You could also setup a Linux system and bind it to AD using LDAP and kerberos.

Are they asking a particular thing is authenticating with Kerberos instead of NTLM?

# ? Jan 26, 2015 23:37

MC Fruit Stripe: Nov 26, 2002; around and around we go

FISHMANPET posted:

You could also setup a Linux system and bind it to AD using LDAP and kerberos.

Are they asking a particular thing is authenticating with Kerberos instead of NTLM?

Nah it's just a softball question from an auditor.

Do you use NTLM or Kerberos?
We use Kerberos.
Excellent, excellent, if you could send a screenshot of that I'd appreciate it.
Not a problem! (I have no idea how to do that)

One of those, "of course it's Kerberos, go away" moments.

I'll find it, but I do love how sometimes it's the easy questions that throw you for a loop.

# ? Jan 26, 2015 23:46

Potato Salad: Oct 23, 2014; nobody cares

Gyshall posted:

People posting ITT not knowing about Access Based Enumeration

Aaaaaaaaaaaaaaaand it's up! The test group of users is already giving positive feedback to the "I don't have to scroll through thirty folders to find my poo poo" feature.

# ? Jan 27, 2015 01:52

Swink: Apr 18, 2006; Left Side <--- Many Whelps

How can I work ABE into my org when I want to hide folders that are not relevant to the user, but still give them the option to acess them if necessary?

# ? Jan 27, 2015 06:16

Adbot: ADBOT LOVES YOU

# ? May 13, 2024 22:23

Dr. Arbitrary: Mar 15, 2006; Bleak Gremlin

Swink posted:

How can I work ABE into my org when I want to hide folders that are not relevant to the user, but still give them the option to acess them if necessary?

I think you can do something with dollar signs. Like //servera/share$ will be available but hidden.

# ? Jan 27, 2015 06:22

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > Enterprise Microsoft Q&A: Hello for Buttprint

«‹›261 »